Passive reconnaissance

Active Reconnaissance

BBot


bbot -t target_domain_1, target_domain_2 -p kitchen-sink --allow-deadly --force -c modules.github_org.api_key=API_KEY_GITHUB,modules.shodan.api_key=API_KEY_SHODAN -o /path/to/bbot/dir/output

BBot create an output.csv file. It contains all rows tagged with some [value].

Extract OPEN_TCP_PORT:

awk -F ',' '$1 == "OPEN_TCP_PORT" {print $2}' output.csv

Extract domain and subdomain correlated using DNS_NAME:

awk -F ',' '$1 == "DNS_NAME" {print $2}' output.csv

Extract URL:

awk -F ',' '$1 == "URL" {print $2}' output.csv

Extract CODE_REPOSITORY:

awk -F ',' '$1 == "CODE_REPOSITORY" {print $2}' output.csv

Nmap

Get the standard ports and run all the scripts and checks on them: